USPS Spam Delivering Asprox Variant

UPDATE: The botnet which is described here is called 'Asprox'. I've compared research with that seen from StopMalvertising.

Recent email spam has begun taking advantage of user's need to snail mail something.  The attacker will forward a message supposedly from USPS in order to get victim's to click on a link purported to be a shipping receipt, which actually leads to a malicious file.  If the user is unfortunate enough to click the link in the spam mail, a zip file containing a variant of Asprox is downloaded.

At the time of research, the VT score was 4/53

Once the file makes it way onto the desktop, it feigns a document icon in order to trick the user into thinking it is safe to view.  This is actually the malicious executable which scored 4/53 on initial VirusTotal scans.

Never trust an icon!  Check the 'Right Click > Properties' to see the true extension

The file itself creates local copies of itself in the logged-in User's Local Application Data and creates an autostarter to ensure that the victim stays infected after restarting their compromised PC.

The threat installs a randomly generated Autostarter value

ThreatLabZ has monitored this infection for a few days and observed several other download locations that kick off this threat.

All links download a similar package.  A third party sandbox analysis is available here

The common factor across all of these dropped files is that they all POST bzip2 compressed data which is then encrypted with a 16-byte random RC4 key via HTTP as reported by StopMalvertising.  We're seeing a growing number of attacks which utilize this method of phone home activity. The case of this Asprox threat phones home over ports 443 and 8080.

Communication is sent over port 8080 or 443

ThreatLabZ collected numerous IPs which were seen to communicate with malicious variants mentioned above.

IPs which communicated with Malicious samples.

Users and Administrators should be cautious of all traffic regardless of the ports it communicates on.  Attackers are leveraging nonstandard HTTP ports in order to bypass some security solutions.

Spearphishing Connects PCs to Russian Botnet

The talent over at MalwareBytes wrote this week about a Zbot dropper which comes from a PDF exploit through a spear-phishing e-mail.  In their blog, they discuss how a spear-phishing attempts to exploit either CVE-2013-0640 or CVE-2013-2729. User's must be extra cautious dealing with any attachment in an e-mail, but this threat merits extreme concern.  It installs a very persistent rootkit and logs the victim into a botnet which receives new commands/tasks every 10 minutes.  Removal is near impossible and also will use your Windows Mail to spear-phish your contact list.

As noted by MalwareBytes, attackers often use false extensions in order to infect victims (such as totally_legit.doc.exe). In the case of this attack, victim's download and click a malicious PDF.  This PDF, as Malwarebytes mentions, exploits Adobe Reader 11 and downloads an executable file.  At the time of research, 18/51 AV companies saw through this ruse and blocked the content before it had a chance to further exploit the victim.

We obtained a copy of the same malware in the Zscaler cloud and noted the following observations. A dropped file immediately connects to a Russian IP address to set up its beaconing activity as well as download more malicious PE files to the victim's machine.

axisbuild[.]com is showing some suspicious activity besides beaconing.

The translation of the C&C configuration file seen above in English is:

Интервал обращения к серверу в минутах

('Interval back to the server in minutes')

Таймаут цикличного обращения по ссылкам в минутах

('Timeout cyclical treatment referred to in minutes')

Список ссылок c&c

('The list of references c & c')

Страна бота

('Country bot')

Список задач

('task List')

In addition to awaiting for further commands from a remote server, the threat will also make many edits to the vicitm's system in order to remain despite removal processes.

There are several locations where this threat might download additional malicious PE files.  I've added a brief list below to illustrate.  I will provide more upon request to interested security professionals.

There are other locations used to download malicious files.

We took all different versions of these files and combined the phone home traffic to give a full list of IPs contacted.  The dropped files immediately begin to contact various IP addresses using nonstandard ports.  The following is a list of IPs and their hosted country.  

List of nonstandard ports used by all variants.

List of IP addresses which were contacted across all variants.

Administrators should monitor their networks for any activity which might match the outgoing transactions above.  Administrators will have a really tough time removing the threat due to the creation of a rootkit and altering the system's boot sequence.  The Zbot variant maintains a high level of persistence by doing the following:

This allows for untested drivers to be executed as part of the boot process

• Uses bcdedit to modify the Windows boot settings.

Dropped files create a system driver which executes during boot sequence.

• Spawns drivers in the Windows Directory

The Autostarter value is randomly generated

• Creates an autostart registry key

Used to inject malicious process into kernel.

• Registers kernel notifiers (kernel callbacks)

The victim is used as a node in further spear-phishing campaigns.

• Manipulates Windows Mail files

Users and Administrators must take extra caution against suspicious attachments.  Common methods for APT infection include tricking users to go to a compromised website or downloading something malicious through an attachment.  The fact that this threat compromises Windows Mail files means that the victim can be used to attack your contact list.  This allows for the attack to circumvent spam lists and base protections employed by regular users.  The best solution is to employ a sandboxing solution against all files which come through e-mail.

Analysis of a VBScript bot

Introduction:

In the long list of complex threats that we see daily, it is interesting to see malware that is rather simple but effective in terms of the payload that it carries. At Zscaler ThreatLabZ, we recently 

came across one such innocent looking Bot, which targeted our customers. The file arrived as an attachment to a spam email message. The malware was written in VBScript.

Analysis:

Virustotal scan results show 14 out of 50 vendors detecting the malware.

Figure 1: Virus-total Result

The image below shows the malware opened in notepad. We can see that the file is obfuscated. That’s because the file has a “.vbe” extension (a “.vbe” is an encoded VBscript file), which would otherwise have a “.vbs” extension. The encoding support is provided to prevent people from reading the script.

Figure 2: Obfuscated VBScript

To be persistent, the malware copies itself into the startup folder in Windows (Figure 3)

Figure 3: Copy of Malware in the startup folder

Registry entry created by the malware to run itself at the system startup.(Figure 4)

Figure 4: Windows Registry (run entry)

It also adds a copy of itself to the Windows temporary folder (Figure 5).

Figure 5: Copy of Malware in temp folder

Next, the malware attempts to establish a connection to it's server (here wscript.exe is the Script Engine which executes VBScript).

Figure 6: Network communication

To extract more information we need to decode the file and obtain the original malware code in a readable form. Let's have a look at the decoded file.

Figure 7: Malware install code

The image above shows the code that is responsible for adding entry in the registry which 

allows the malware to execute every time the system starts , Also create it's own copy in the startup, temporary folder.

Another interesting part of this malware is it's ability to communicate over the network. The malware can actually receive a set of commands and execute them in an infected machine

At the time of analysis, the server to which the malware communicates seems to be down. Therefore, in order to fully understand how the malware communicates and also to demonstrate how effective and damaging this Bot is, I have decided to create an HTTP server and issue commands to the bot directly.

We can see from the code below, the wide range of commands that can be executed by this Bot. The commands are simple and self explanatory. 

Figure 8: Remote Commands

Let's see the effects of a few of these commands in detail. The “execute” command is capable of executing additional VBScript statements in the infected machine. The “update” command is issued to update the Bot , while “uninstall” removes the Bot entry from the Windows registry and startup folder.

There are also commands such as “send”, ”recv” and “site-send”. Interesting commands include “enum-driver”, “enum-faf”, “enum-process”, “cmd-shell”, “delete”, “exitprocess”.

Let us execute our server and wait for the Bot to connect to us and send information so we can then issue commands.

Figure 9: Malware callback

As seen in the image above, a “POST” request is made with it's path as “/is-ready”, indicating

that the Bot is up and ready. We can also observe information about the infected machine such as “volumeserialnumber”, “computername”, “username”,“operating system type”, installed

“anti-virus name” etc. To retrieve such information, the malware relies on Windows Management Instrumentation (WMI) queries.

Let us issue the command “enum-driver”. This command fetches the drive name and drive type of the infected machine as seen in the image below.

Figure 10: enum-drive

The next command “enum-faf” enumerates and fetches the content of an input directory or drive of the infected machine.

Figure 11: enum files 

The “enum-process” command fetches a list of processes that are running on the infected system.

Figure 12: enum-process

The “cmd-shell” command will allow the attacker to execute all DOS commands on the infected

system.

Figure 13: Execute Dos Command

Those are just a few of the powerful commands that the malware can execute in the infected system. This gives the malware near limitless power to control and steal data from the infected machine. The Bot and all it's communication are blocked by Zscaler.

The story of a Trojan Dropper I

Introduction:

Recently, Zscaler ThreatlabZ  received a suspicious file from one of our customers, which 

was named “OrderDetails.zip”. After extracting the executable file from the archive I have 
performed a virustotal scan  to get some information about the file. At that time, very 
few antivirus vendors had definitions in place, which flagged the file as malicious.

As such, I decided to take look at the file in greater detail. After completing the analysis,
I've  decided to blog about the threat. Given the amount of information derived during the analysis, I've decided to divide the blog into multiple parts.

Figure 1:  virus total results

Modern day malware generally implements some kind of packing or obfuscation on the binary, in order to evade antivirus detection. Hence, it’s a good idea to determine which packer may have been used while analyzing the file. In order to do this, I implemented a popular tool called PEiD to check for the existence of a known packer.

Figure 2:  PEiD results

As we can see above, PEiD was not able to pick up anything from this file, but that doesn't mean that the file is not packed. Let’s have a closer look at the file.

While going through the file sections, one of the sections (.data) contained an unusually large amount of data, which at first glance gave the impression that it is obfuscated. This is an important clue and something we have to keep in mind while debugging the file.

Figure 3:  obfuscated data

While looking at the resource section, we can see that the file icon resembles that of a PDF file, which adds to our suspicion. Also, the file is not digitally signed.

Figure 4: File icon at resource section

Lets go further and execute the file. When doing so, I was greeted with a crash report where Windows was telling me that “Adobe.exe” had crashed during execution.

Figure 5:  windows error report 

We knew from the beginning that this was not a proper PDF file and would not therefore work with Adobe Reader. Let’s now look to determine where Adobe.exe exists in the file system. A 
Windows file search reveals Adobe.exe inside the temp folder, which when executed, produces exactly the same result as was shown above 

Figure 6: dropped file named adobe.exe

At the same time, a Wireshark capture was not able to output anything that was of interest.At this point we have adequate evidence to proceed with additional debugging, which i will explain in detail in the 2nd part of this blog post. The story of a Trojan dropper II

Figure 7: wireshark packet capture

Rise in Red Kit Exploit Kit Activity

This week, a malicious pattern of activity was observed in websites being compromised, which in turn redirected to a Red Kit exploit kit (EK) landing page. Some infected websites that were seen:

• neptunebenson[dot]com
• route66marathon[dot]com
• whitesteeple[dot]com 

(Warning! these sites may still be infected). 

Two different mechanisms were used to infect the websites. The first one being a standard iframe injection, which leads to the Red Kit EK landing page through URL redirections. The other mechanism leverages SEO based techniques to carry out HTTP 302 redirections that lead to the RedKit EK landing page.

The snapshot below shows some of the sample URLs/SEO redirections that were seen. Please refer to this URLQuery search in order to identify other URLs exhibiting the redirection patterns.  

Upon visiting the infected webpage, it sends the user to a malicious redirection (HTTP 302). The actual exploit code as shown below is then ultimately delivered.

The first landing page uses a typical RedKit Exploit, which contains the obfuscated URL that is used to fetch the payload as shown in the highlighted box below. 

The Java Sandbox bypass exploit is carried out leveraging an unsigned applet with the suspicious parameter "__applet_ssv_validated" passed, which exploits the following vulnerabilities:  CVE-2013-1493 / CVE-2013-2423 / CVE-2012-1723.

The jar applet gets the obfuscated URL from the parameter "name", which is passed by the jnlp as shown above. It is then decoded into the final URL through the following code: 

This URL contains the encrypted binary payload. The applet creates a URL Connection Steam to download the encrypted binary stream. The binary stream is then decrypted using the AES CBC 128 bit cipher block chaining scheme. The IV (Initial Vector) and the decryption key are stored inside the applet. After decryption, it stores the binary file onto the temporary folder with a random filename by making a call to java.io.tmpdir. The snapshot below summarizes some of the important routines involved in the decryption process.

The binary file was packed using UPX and has anti-vm/anti-debugging detection routines. The binary is a Keylogger Tojan that steals credentials such as credit card numbers, passwords etc. and sends it over to a remote location. Currently, the binary is being detected only by three AV vendors as malicious. 

Binary Reports:

https://www.virustotal.com/en/file/33dca051d6ad48d09fdee7a14dfacc32c174616743ea16421d6fa4ccb77aeb71/analysis/

http://www.threatexpert.com/report.aspx?md5=61925c0254ca1b8704b1fb78faedaaaf

Jar File Report: 

https://www.virustotal.com/en/file/13bfc250788893efaf9f8ad7d98fe1f01e5eb28f025fcdac9013470c7c9635fb/analysis/

It is always a good practice to keep vulnerable browser plugins such as Adobe/Java constantly updated. This protects the end user from malicious EKs leveraging known vulnerabilities. For more specfic information related to Java Plugins and how to disable them, please refer this great blog post from my colleague Julien Sobrier.

Hijacked websites by the numbers

Two weeks ago, I had the chance to give a presentation about the danger of hijacked websites (you can download the presentation in French here). I used the talk to highlight various points which illustrate the extent of the problem.

Some numbers

70% of malicious links were found on hijacked websites in 2011 (Sophos, page 39). In 2012, Google is finding 9,500 newly malicious websites every day, mostly hijacked sites (Google, 2012). The Blackhole exploit kit alone is estimated to be present on several million websites per year (AVG, weekly count).

Nikkju, a web based worm that used SQL injection to spread, has infected about 200,000 websites. Lizamoon, which started propagating in 2010, infected about 1.5 million websites via SQL injection.


High profile victims

Since the hijacking of websites is mostly automated, websites of all types are getting compromised. Here are some of the high-profile websites that have been hijacked:

• 2012: French budget minister, Cleartrip (India), Computer World Mexico, and most of the top-1,000 websites blacklisted by Google like blog.com (#649), fatakat.com (#699), ziddu.com (#802)
• 2011: MySQL, Geek.com, USPS, Lenovo India, etc.

The list of hijacked websites includes many governmental websites from all over the world, including the United States.

Vulnerable software

The attack surface of website is quite large, an attacker can target the CMS, its plugins, administration tools (PHPMyAdmin, Plesk, cPanel - tools which should not be publicly accessible), the web server, the FTP server, the DNS server, etc.

I looked at the number of CVEs issued in 2012 for the most popular software platforms in these areas:

• WordPress: 14 CVEs for the core, 42 for extensions, including security extensions that are supposed to make WordPress safer.
• Joomla: 7 in core
• Drupal: 20+ in core
• PHPMyAdmin: 5 - Gemenenet, a security company, was compromised through a vulnerability in PHPMyAdmin
• cPanel: 50,000 compromised through one attack
• Plesk: 1 CVE, but 50,000 websites compromised through it
• Apache: 30+ CVE (core and modules)
• BIND: 6 CVEs
• etc.

Some hosting companies were compromised as well: DreamHost (January 2012), ServerPro (February 2012), WHMCS (May 2012, provides billing and technical support to smaller hosting companies).

In your mail box

If you want some examples of hijacked websites redirecting users to malicious pages, you can take a look at your inbox. Just this morning, I received four similar messages about a fictitious payment sent to me through Intuit:

Malicious e-mail

All the links and buttons point to the same URL on a hijacked site:

• www.eyslerimaging.com/blog/wp-content/plugins/flickr-widget/iprprocsd.html (photography blog)
• www.odiseya.net/wp-content/themes/twentyten/bewpinfr.html
• user3.inet.vn/wp-content/plugins/iprprocsd.html

These pages redirect to the same malicious page hxxp://navisiteseparation.net/detects/processing-details_requested.php. This page runs a malicious Java Applet. Unfortunately, I could not retrieve the content a second time for further analysis.

This is just one of the many spam campaigns that lead visitors to a malicious site.

Most common threats in top blacklisted sites

The vast majority of the most popular blacklisted websites contain a piece of malicious JavaScript inline. These sites were mostly hijacked by attackers and the malicious code can usually be linked to the Blackhole exploit kit.

Malicious code found on top blacklisted sites

I was surprised to find malicious Java applets in second place, having been found on 10% of the blocked sites. Malicious iFRAMEs were the third most prevalent infection and generally resulted from  mass SQL injection attacks. Only 2% of the sites are trying to foil users into downloading a malicious piece of code through a fake AV, Flash or codec page.

The scam and spam sites are mostly survey scams (the-rewardline.com, station-awardz-central.com, channelrewardscenter.org, etc.) and work-from-home scams (financereports.co). These sites have been blocked by Google Safe Browsing for months.

Since most the blocked sites are legitimate sites with high traffic, they quickly get cleaned up and removed from the Google blacklist. While the average number of days a top-site is blocked by Google is 7 days, the graph below shows that the vast majority are blocked for only a few days:

The number of top-domains blacklisted, can vary considerably on a daily basis, but the trend is upward - from an average of 400 sites in May to more than 1,000 in July.

Number of top-websites blacklisted daily by Google

Here are the top-ranked websites blacklisted by Google since May 2012:

Domain	Alexa rank	Country
blog.com	681	PT
fatakat.com	699	US
ziddu.com	878	GB
warez-bb.org	1,029	RU
vanguardngr.com	1,528	US
prlog.org	1,555	US
damnlol.com	1,949	US
arabseed.com	2,002	US
h33t.com	2,213	CA
geo.tv	2,606	GB

Small or big, popular or not, all websites are under attack. No domain can be fully trusted and you never know if attackers managed to breach the protections of the website that you're currently on.